summaryrefslogtreecommitdiff
path: root/qobject/json-streamer.c
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2015-11-25 22:23:33 +0100
committerMarkus Armbruster <armbru@redhat.com>2015-11-26 10:07:07 +0100
commitdf649835fe48f635a93316fdefe96ced7189316e (patch)
tree5460f95750d89543d73be1b7c125260f1d8e9f47 /qobject/json-streamer.c
parent9bada8971173345ceb37ed1a47b00a01a4dd48cf (diff)
downloadqemu-df649835fe48f635a93316fdefe96ced7189316e.tar.gz
qemu-df649835fe48f635a93316fdefe96ced7189316e.tar.bz2
qemu-df649835fe48f635a93316fdefe96ced7189316e.zip
qjson: Limit number of tokens in addition to total size
Commit 29c75dd "json-streamer: limit the maximum recursion depth and maximum token count" attempts to guard against excessive heap usage by limiting total token size (it says "token count", but that's a lie). Total token size is a rather imprecise predictor of heap usage: many small tokens use more space than few large tokens with the same input size, because there's a constant per-token overhead: 37 bytes on my system. Tighten this up: limit the token count to 2Mi. Chosen to roughly match the 64MiB total token size limit. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1448486613-17634-13-git-send-email-armbru@redhat.com>
Diffstat (limited to 'qobject/json-streamer.c')
-rw-r--r--qobject/json-streamer.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/qobject/json-streamer.c b/qobject/json-streamer.c
index e87230d681..a4db4b832e 100644
--- a/qobject/json-streamer.c
+++ b/qobject/json-streamer.c
@@ -16,6 +16,7 @@
#include "qapi/qmp/json-streamer.h"
#define MAX_TOKEN_SIZE (64ULL << 20)
+#define MAX_TOKEN_COUNT (2ULL << 20)
#define MAX_NESTING (1ULL << 10)
static void json_message_free_tokens(JSONMessageParser *parser)
@@ -68,6 +69,7 @@ static void json_message_process_token(JSONLexer *lexer, GString *input,
parser->bracket_count == 0)) {
goto out_emit;
} else if (parser->token_size > MAX_TOKEN_SIZE ||
+ g_queue_get_length(parser->tokens) > MAX_TOKEN_COUNT ||
parser->bracket_count + parser->brace_count > MAX_NESTING) {
/* Security consideration, we limit total memory allocated per object
* and the maximum recursion depth that a message can force.